{ "data": { "similar": [ { "grade": "A", "json": "https://www.anchorterminal.com/tools/descope-agentic-identity.json", "name": "Descope Agentic Identity Hub", "score": 78.1, "shared": [ "auth.oauth", "auth.tokens", "auth.consent" ], "slug": "descope-agentic-identity" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/agentcore-identity.json", "name": "Amazon Bedrock AgentCore Identity", "score": 76.4, "shared": [ "auth.oauth", "auth.tokens", "auth.consent" ], "slug": "agentcore-identity" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/auth0-ai-agents.json", "name": "Auth0 for AI Agents (Token Vault)", "score": 74.3, "shared": [ "auth.oauth", "auth.tokens", "auth.consent" ], "slug": "auth0-ai-agents" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/scalekit-agentkit.json", "name": "Scalekit AgentKit", "score": 72.2, "shared": [ "auth.oauth", "auth.tokens", "auth.consent" ], "slug": "scalekit-agentkit" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/vercel-connect.json", "name": "Vercel Connect", "score": 70.8, "shared": [ "auth.tokens", "auth.oauth", "auth.consent" ], "slug": "vercel-connect" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/aembit.json", "name": "Aembit", "score": 68.4, "shared": [ "auth.oauth", "auth.tokens", "auth.consent" ], "slug": "aembit" } ], "tool": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 74, "points": 14.8, "reason": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 86, "points": 13.98, "reason": "Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 80, "points": 14, "reason": "OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 50, "points": 6.25, "reason": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 87, "points": 7.61, "reason": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 86, "points": 7.53, "note": "editorial 77, provenance 95", "reason": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.", "maintenance": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "payments": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "reliability": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.", "schema": "Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.", "security": "OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.", "transparency": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77." }, "sources": [ { "what": "repository, README, docs, SECURITY.md and HISTORY.md (clone)", "url": "https://github.com/cloudflare/workers-oauth-provider", "seen": "2026-11-06" }, { "what": "changelog", "url": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "seen": "2026-11-06" }, { "what": "storage schema", "url": "https://github.com/cloudflare/workers-oauth-provider/blob/main/storage-schema.md", "seen": "2026-11-06" }, { "what": "open issues", "url": "https://github.com/cloudflare/workers-oauth-provider/issues", "seen": "2026-11-06" }, { "what": "npm registry", "url": "https://www.npmjs.com/package/@cloudflare/workers-oauth-provider", "seen": "2026-11-06" }, { "what": "MCP authorization docs (27 October 2026)", "url": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "seen": "2026-11-06" } ], "openQuestions": [ "The lead was right on the library, the providers and that no GA label is shown; the package is at 1.2.4 and the docs page carries no beta label. GitHub and Google appear only as upstream sign-in options, not as worked examples.", "Category agent-auth as suggested. auth.oauth first, since issuing OAuth tokens to agents' MCP clients is its job.", "Judgement call. 1.2.0 shipped a change its changelog calls breaking in a minor version, on the day it shipped. It's a security tightening in line with OAuth 2.1, so it's scored in Reliability's semver line rather than deducted.", "Disclosure. HISTORY.md says the library was largely written with Claude. Our research agents also run on Claude; it was graded by the same checklist.", "unchecked: CI run results, because GitHub's API answered with a rate limit.", "Company facts and the humans file are taken from the existing Cloudflare listings, as the batch rules ask." ] }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "BB", "kind": "listed", "method": "0.7", "score": 76.2 } ] }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "notable": [ "v1.2.4 published to npm on 22 October 2026 with provenance, nine npm releases in the 90 days to 6 November and first published on 16 March 2025 (https://www.npmjs.com/package/@cloudflare/workers-oauth-provider)", "The 1.2.0 changelog entry, a minor release, says clients registered with a remote http redirect URI or a private-use scheme stop authorizing, with an opt-in for RFC 8252 native-app schemes (https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md)", "storage-schema.md says client secrets are stored as SHA-256 hashes, props are AES-GCM encrypted and tokens and codes expire through KV TTLs; dynamically registered clients default to 90 days (https://github.com/cloudflare/workers-oauth-provider/blob/main/storage-schema.md)", "HISTORY.md says the library was largely written with the help of Claude and reviewed line by line by Cloudflare engineers against the RFCs (https://github.com/cloudflare/workers-oauth-provider/blob/main/HISTORY.md)", "Open issues filed on 24 and 28 October 2026 report that an authorization code can be exchanged twice under concurrent token requests and that grant revocation isn't final under KV eventual consistency, neither with a reply on 6 November (https://github.com/cloudflare/workers-oauth-provider/issues)", "Cloudflare's MCP authorization page, last updated 27 October 2026, gives deployable examples with Stytch, Auth0, WorkOS and Descope (https://developers.cloudflare.com/agents/model-context-protocol/authorization/)" ], "area": "agent-runtime", "details": [ { "label": "Surface listed", "value": "The `@cloudflare/workers-oauth-provider` library 1.2.4, read from a clone of github.com/cloudflare/workers-oauth-provider, the npm registry and Cloudflare's MCP authorization page on 6 November 2026. Nothing was installed or deployed" }, { "label": "Not covered elsewhere", "value": "No Cloudflare listing covers this library on 6 November 2026; cloudflare-mcp is Cloudflare's own MCP server and cloudflare-sandbox-sdk its sandboxes" }, { "label": "Roles", "value": "`OAuthAuthorizationServer` signs users in and issues tokens; `OAuthResourceServer` wraps the MCP endpoint and validates tokens over a Service Binding" }, { "label": "Standards", "value": "OAuth 2.1 with PKCE, RFC 9728 protected-resource metadata, resource indicators, token revocation, optional dynamic client registration, Client ID Metadata Documents and private_key_jwt client assertions" }, { "label": "Docs", "value": "README, seven Markdown guides (authorization server, resource servers, consent page, upstream sign-in, MCP discovery, advanced configuration, migration to 1.x), a storage schema and an agent skill for migrating" }, { "label": "Legal entity", "value": "Cloudflare, Inc., the copyright holder in LICENSE.txt" } ], "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95, "checks": [ { "check": "Legal entity named", "value": "Cloudflare, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "cloudflare.com, registered 2009-02-17 (17 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "www.cloudflarestatus.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" }, { "check": "People named", "value": "4 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.cloudflare.com/terms/", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-09-12", "words": 7048, "points": 6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated September 12, 2025", "says": "Last updated 2025-09-12" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement will be governed by the laws of the State of California without regard to conflict of law principles.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…THROUGH THE SERVICES) OR OTHERWISE UNDER THIS AGREEMENT, WHETHER IN CONTRACT, TORT, OR OTHERWISE, IS LIMITED TO THE AMOUNTS YOU HAVE PAID TO CLOUDFLARE TO ACCESS AND USE THE SERVICE IN THE 12 MONTHS PRIOR TO THE CLAIM.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may discontinue, suspend, or remove Beta Services (including any of Customer Content stored as part of the Beta Services) or your access thereto at any time in our sole discretion and may never make them generally available." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Unless otherwise specified, any modifications to this Agreement will take effect at the start of Subscription Term following the notice.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Unless otherwise expressly permitted in writing by Cloudflare, you will not and you have no right to:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Service Level Agreements" } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(e) introduce software or automated agents or scripts into the Services so as to produce multiple accounts, generate automated searches, requests or queries, or to strip or mine data from the Services;", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We also reserve the right to modify or discontinue the Service at any time (including, without limitation, by limiting or discontinuing certain features of the Service) without notice to you.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "THIS AGREEMENT CONTAINS PROVISIONS REQUIRING THAT YOU AGREE TO THE USE OF ARBITRATION TO RESOLVE ANY DISPUTES ARISING UNDER THIS AGREEMENT RATHER THAN A JURY TRIAL OR ANY OTHER COURT PROCEEDINGS, AND TO WAIVE YOUR PARTICIPATION IN CLASS ACTION OF ANY KIND AGAINST CLOUDFLARE." } ], "notes": [ { "date": "2026-10-08", "text": "A customer who lets a third party into the account with an API token or OAuth does so at its own risk, and that party may change or delete account data.", "quote": "You acknowledge that by permitting a third party to access your Cloudflare account, the third party may obtain, modify, or delete your account data and settings." }, { "date": "2026-10-08", "text": "Fees are non-refundable, and a customer who cancels is billed in full for the subscription term in which it cancels.", "quote": "YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM." }, { "date": "2026-10-08", "text": "Cloudflare accepts no liability for harm arising from free or trial versions of the Services.", "quote": "We will have no liability for any harm or damage arising out of or in connection with any Free Services." } ] }, { "kind": "privacy", "url": "https://www.cloudflare.com/privacypolicy/", "state": "read", "readAt": "2026-10-08", "words": 7595, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Customer Account Information: When you register for an account, we collect contact information." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of this policy or as long as needed to fulfill and comply with legal obligations.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Non-personally identifiable, aggregated data may be shared with third parties." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We will not sell or rent your personal information.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Where we rely on your consent to process your personal data, you have the right to withdraw or decline consent at any time." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us at privacyquestions@cloudflare.com.", "says": "privacyquestions@cloudflare.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "The Global CBPR System means the data privacy framework established by the Global CBPR Forum against which data controllers can voluntarily certify and undergo assessment by third-party accountability agents to enable accountable cross-border data flows among participating jurisdictions, and the Global PRP System mean…", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Making Personal Information (such as online identifiers or browsing activity) available to these companies may be considered a “sale” or “sharing” of your Personal Information under the CCPA." } ] } ] }, "humans": { "slug": "cloudflare-workers-oauth-provider", "checked": "2026-11-06", "company": "Cloudflare", "people": [ { "name": "Matthew Prince", "role": "Co-founder, CEO and Co-chair, Cloudflare", "founder": true, "photo": "/assets/img/people/cloudflare-matthew-prince.webp", "photoSource": "https://www.cloudflare.com/connect/cold-start/", "bio": "Matthew Prince co-founded Cloudflare in 2009 with Michelle Zatlyn and Lee Holloway and is its CEO and co-chair. He and Holloway had earlier built Project Honey Pot, which tracked how spammers harvest email addresses, and he developed the Cloudflare business plan with Zatlyn while studying at Harvard Business School.", "bioSources": [ "https://www.cloudflare.com/our-story/", "https://en.wikipedia.org/wiki/Cloudflare" ], "page": "/people/matthew-prince/" }, { "name": "Michelle Zatlyn", "role": "Co-founder, President and Co-chair, Cloudflare", "founder": true, "photo": "/assets/img/people/cloudflare-michelle-zatlyn.webp", "photoSource": "https://www.cloudflare.com/connect/cold-start/", "bio": "Michelle Zatlyn co-founded Cloudflare in 2009 with Matthew Prince and Lee Holloway and is its president and co-chair. She met Prince at Harvard Business School, where the two wrote the Cloudflare business plan that won the school's business plan competition in April 2009.", "bioSources": [ "https://www.cloudflare.com/our-story/", "https://en.wikipedia.org/wiki/Cloudflare" ], "page": "/people/michelle-zatlyn/" }, { "name": "Lee Holloway", "role": "Co-founder, Cloudflare", "founder": true, "bio": "Lee Holloway co-founded Cloudflare in 2009 with Matthew Prince and Michelle Zatlyn. He had earlier built Project Honey Pot with Prince, a system for tracking how spammers harvest email addresses, and he built the first working Cloudflare prototype.", "bioSources": [ "https://www.cloudflare.com/our-story/", "https://en.wikipedia.org/wiki/Cloudflare" ], "page": "/people/lee-holloway/" }, { "name": "Dane Knecht", "role": "Chief Technology Officer, Cloudflare", "photo": "/assets/img/people/cloudflare-dane-knecht.webp", "photoSource": "https://www.cloudflare.com/connect/cold-start/", "page": "/people/dane-knecht/" } ], "peopleNote": "Cloudflare's page for The Cold Start at Cloudflare Connect 2026 (read on 28 October 2026) shows Matthew Prince as Co-founder and CEO, Michelle Zatlyn as Co-founder and President and Dane Knecht as CTO, each in a card with their name and portrait, and the blog post introducing it names Zatlyn as co-founder and President. Cloudflare's press release of 20 October 2026 also names Knecht as chief technology officer. The co-chair titles come from Wikipedia's Cloudflare article. Lee Holloway's step-down in 2015 was sourced to TechCrunch, which its robots.txt puts off limits, so it was dropped from his role on 6 November 2026. Product people stay on their own listings. Copied from the cloudflare-sandbox-sdk listing on 6 November 2026 without its product manager; the library's changelog credits maintainers by GitHub handle only. On 6 November 2026 the GitHub issues link was corrected from the Sandbox SDK's to this library's repository, and the Sandbox SDK's product-team sources were removed.", "companySocial": { "linkedin": "https://www.linkedin.com/company/cloudflare", "x": "https://x.com/cloudflare", "github": "https://github.com/cloudflare" }, "support": { "urls": [ "https://developers.cloudflare.com/support/contacting-cloudflare-support/" ], "community": [ { "label": "Developer Discord", "url": "https://discord.cloudflare.com", "kind": "discord" }, { "label": "Forum", "url": "https://community.cloudflare.com", "kind": "forum" }, { "label": "GitHub issues", "url": "https://github.com/cloudflare/workers-oauth-provider/issues", "kind": "github" } ] }, "sources": [ "https://www.cloudflare.com/our-story/", "https://www.cloudflare.com/", "https://developers.cloudflare.com/support/", "https://developers.cloudflare.com/support/contacting-cloudflare-support/", "https://developers.cloudflare.com/", "https://github.com/cloudflare/workers-oauth-provider", "https://www.cloudflare.com/connect/cold-start/" ], "ownership": { "status": "public", "exchange": "NYSE", "ticker": "NET", "checked": "2026-10-28", "sources": [ "https://www.cloudflare.com/press/press-releases/2026/more-than-10-million-developers-are-building-on-cloudflare/", "https://en.wikipedia.org/wiki/Cloudflare" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T17:45:16.553526312Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T17:45:16.553526312Z" } }, "verify": { "accepts": "a page on cloudflare.com or one of its subdomains, or the README at the root of github.com/cloudflare/workers-oauth-provider", "badgeUrl": "https://www.anchorterminal.com/badges/cloudflare-workers-oauth-provider.svg", "body": { "slug": "cloudflare-workers-oauth-provider", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/cloudflare-workers-oauth-provider.svg\" alt=\"Cloudflare Workers OAuth Provider on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Cloudflare Workers OAuth Provider on Anchor Terminal](https://www.anchorterminal.com/badges/cloudflare-workers-oauth-provider.svg)](https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider\"\u003eCloudflare Workers OAuth Provider on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "json": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider#pricing", "reviews": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider#reviews", "slim": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md" }, "markdown": "## Overview\n\n**Grade BB · 76.2/100 · rank #47 of 1486 · #4 in Agent auth \u0026 delegated access · agent-ready · confidence medium**\n\n\nMore from Cloudflare, listed separately because each is its own product: [Cloudflare AI Gateway](https://www.anchorterminal.com/tools/cloudflare-ai-gateway.md) (Model APIs \u0026 inference), [Cloudflare Workers AI](https://www.anchorterminal.com/tools/cloudflare-workers-ai.md) (Model APIs \u0026 inference), [Cloudflare Sandbox SDK](https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.md) (Code execution sandboxes), [Cloudflare Web Search API](https://www.anchorterminal.com/tools/cloudflare-web-search.md) (Web search APIs), [Clairic](https://www.anchorterminal.com/tools/cloudflare-clairic.md) (Document parsing \u0026 extraction), [Cloudflare AI Search](https://www.anchorterminal.com/tools/cloudflare-ai-search.md) (Retrieval \u0026 vector search), [Cloudflare CLI (cf)](https://www.anchorterminal.com/tools/cloudflare-cli.md) (Cloud \u0026 infrastructure), [Cloudflare MCP Servers](https://www.anchorterminal.com/tools/cloudflare-mcp.md) (Cloud \u0026 infrastructure), [Cloudflare Email Service](https://www.anchorterminal.com/tools/cloudflare-email-service.md) (Email delivery APIs), [Cloudflare R2](https://www.anchorterminal.com/tools/cloudflare-r2.md) (File storage \u0026 sharing), [Clef](https://www.anchorterminal.com/tools/cloudflare-clef.md) (Decision models).\n\n## Assessment\n\nCloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Cloudflare (https://developers.cloudflare.com/agents/model-context-protocol/authorization/) |\n| Kind | SDK + MCP |\n| Category | Agent auth \u0026 delegated access (https://www.anchorterminal.com/categories/agent-auth) |\n| Auth | OAuth · The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope. |\n| Pricing | Free (Free · OSS) · Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan. |\n| x402 | No · No x402, MPP or L402 in the source, README or docs (checked 2026-11-06). |\n| Licence | MIT |\n| Packages | npm: `@cloudflare/workers-oauth-provider` |\n| Source | https://github.com/cloudflare/workers-oauth-provider |\n| Docs | https://github.com/cloudflare/workers-oauth-provider/tree/main/docs |\n| llms.txt | not found |\n| Last release | 2026-10-22 |\n| GitHub stars | 1,893 (as of 2026-11-06) |\n| npm downloads / week | 1,122,612 |\n| Surface listed | The `@cloudflare/workers-oauth-provider` library 1.2.4, read from a clone of github.com/cloudflare/workers-oauth-provider, the npm registry and Cloudflare's MCP authorization page on 6 November 2026. Nothing was installed or deployed |\n| Not covered elsewhere | No Cloudflare listing covers this library on 6 November 2026; cloudflare-mcp is Cloudflare's own MCP server and cloudflare-sandbox-sdk its sandboxes |\n| Roles | `OAuthAuthorizationServer` signs users in and issues tokens; `OAuthResourceServer` wraps the MCP endpoint and validates tokens over a Service Binding |\n| Standards | OAuth 2.1 with PKCE, RFC 9728 protected-resource metadata, resource indicators, token revocation, optional dynamic client registration, Client ID Metadata Documents and private_key_jwt client assertions |\n| Docs | README, seven Markdown guides (authorization server, resource servers, consent page, upstream sign-in, MCP discovery, advanced configuration, migration to 1.x), a storage schema and an agent skill for migrating |\n| Legal entity | Cloudflare, Inc., the copyright holder in LICENSE.txt |\n| Capabilities | auth.oauth, auth.tokens, auth.consent |\n| Tags | open-source, mit, typescript, library, cloudflare-workers, oauth-2.1, mcp, pkce, free |\n| JSON | https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json |\n\n## Score breakdown (methodology v0.7, October 2026 research run)\n\nAssessed 2026-11-06 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 74 | 14.8 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 86 | 14.0 |\n| Agent ergonomics | 13% | 16.2 | 74 | 12.0 |\n| Security \u0026 auth | 14% | 17.5 | 80 | 14.0 |\n| Payments \u0026 pricing | 10% | 12.5 | 50 | 6.2 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 87 | 7.6 |\n| Transparency \u0026 trust (editorial 77, provenance 95) | 7% | 8.8 | 86 | 7.5 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **76.2 → BB** |\n\n### Why each score\n\n- Reliability 74 (checked 2026-11-06): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 86 (checked 2026-11-06): Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.\n- Agent ergonomics 74 (checked 2026-11-06): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.\n- Security \u0026 auth 80 (checked 2026-11-06): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.\n- Payments \u0026 pricing 50 (checked 2026-11-06): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 87 (checked 2026-11-06): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n- Transparency \u0026 trust 86 (checked 2026-11-06): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n\nFix list, everything this grade says the listing lacks, the biggest gain first (16 items). What it covers is at https://www.anchorterminal.com/fixes/cloudflare-workers-oauth-provider.md (JSON https://www.anchorterminal.com/fixes/cloudflare-workers-oauth-provider.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{\"listing\": \"cloudflare-workers-oauth-provider\", \"plan\": \"read\"}`, free while the beta runs\n\n### What we couldn't check\n\n- The lead was right on the library, the providers and that no GA label is shown; the package is at 1.2.4 and the docs page carries no beta label. GitHub and Google appear only as upstream sign-in options, not as worked examples.\n- Category agent-auth as suggested. auth.oauth first, since issuing OAuth tokens to agents' MCP clients is its job.\n- Judgement call. 1.2.0 shipped a change its changelog calls breaking in a minor version, on the day it shipped. It's a security tightening in line with OAuth 2.1, so it's scored in Reliability's semver line rather than deducted.\n- Disclosure. HISTORY.md says the library was largely written with Claude. Our research agents also run on Claude; it was graded by the same checklist.\n- unchecked: CI run results, because GitHub's API answered with a rate limit.\n- Company facts and the humans file are taken from the existing Cloudflare listings, as the batch rules ask.\n\n### Sources\n\n- repository, README, docs, SECURITY.md and HISTORY.md (clone): \u003chttps://github.com/cloudflare/workers-oauth-provider\u003e (seen 2026-11-06)\n- changelog: \u003chttps://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md\u003e (seen 2026-11-06)\n- storage schema: \u003chttps://github.com/cloudflare/workers-oauth-provider/blob/main/storage-schema.md\u003e (seen 2026-11-06)\n- open issues: \u003chttps://github.com/cloudflare/workers-oauth-provider/issues\u003e (seen 2026-11-06)\n- npm registry: \u003chttps://www.npmjs.com/package/@cloudflare/workers-oauth-provider\u003e (seen 2026-11-06)\n- MCP authorization docs (27 October 2026): \u003chttps://developers.cloudflare.com/agents/model-context-protocol/authorization/\u003e (seen 2026-11-06)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider/history.json\n\n- 2026-11-06: graded 76.2 BB (methodology 0.7)\n\n## Who's behind it (provenance 95/100, checked 2026-11-06)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Cloudflare, Inc. | 20/20 |\n| Domain age | cloudflare.com, registered 2009-02-17 (17 years) | 15/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points | 6/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | www.cloudflarestatus.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n| People named | 4 named with their role, none with a public profile | 7/10 |\n| Support route | help pages, a community | 5/5 |\n\nCompany facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.\n\nwww.cloudflare.com/.well-known/security.txt answered on 6 November 2026.\n\ndevelopers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.cloudflare.com/terms/), read 2026-10-08, dated 2025-09-12, states 7 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"(e) introduce software or automated agents or scripts into the Services so as to produce multiple accounts, generate automated searches, requests or queries, or to strip or mine data from the Services;\"\n- To know. Says the terms or the service can change without notice (costs points). \"We also reserve the right to modify or discontinue the Service at any time (including, without limitation, by limiting or discontinuing certain features of the Service) without notice to you.\"\n- To know. Says access can be ended without notice or for any reason. \"We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all.\"\n- To know. Requires arbitration or waives class actions. \"THIS AGREEMENT CONTAINS PROVISIONS REQUIRING THAT YOU AGREE TO THE USE OF ARBITRATION TO RESOLVE ANY DISPUTES ARISING UNDER THIS AGREEMENT RATHER THAN A JURY TRIAL OR ANY OTHER COURT PROCEEDINGS, AND TO WAIVE YOUR PARTICIPATION IN CLASS ACTION OF ANY KIND AGAINST CLOUDFLARE.\"\n- Gives the date it was last updated. Last updated 2025-09-12.\n- Names the governing law or courts. The law of the State of California.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Also in the text (2026-10-08). A customer who lets a third party into the account with an API token or OAuth does so at its own risk, and that party may change or delete account data. \"You acknowledge that by permitting a third party to access your Cloudflare account, the third party may obtain, modify, or delete your account data and settings.\"\n- Also in the text (2026-10-08). Fees are non-refundable, and a customer who cancels is billed in full for the subscription term in which it cancels. \"YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM.\"\n- Also in the text (2026-10-08). Cloudflare accepts no liability for harm arising from free or trial versions of the Services. \"We will have no liability for any harm or damage arising out of or in connection with any Free Services.\"\n\n**Privacy policy** (https://www.cloudflare.com/privacypolicy/), read 2026-10-08, gives no date, states 7 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"Making Personal Information (such as online identifiers or browsing activity) available to these companies may be considered a “sale” or “sharing” of your Personal Information under the CCPA.\"\n- Not found in the text. Gives the date it was last updated.\n- Says how long data is kept. For as long as needed, with no period named.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. privacyquestions@cloudflare.com.\n- Says where data is transferred or stored. Relies on the Data Privacy Framework.\n\n## Humans behind the project (researched 2026-11-06 from public pages, not part of the grade)\n\n### Key people\n\n- Matthew Prince, Co-founder, CEO and Co-chair, Cloudflare\n- Michelle Zatlyn, Co-founder, President and Co-chair, Cloudflare\n- Lee Holloway, Co-founder, Cloudflare\n- Dane Knecht, Chief Technology Officer, Cloudflare\n- Note: Cloudflare's page for The Cold Start at Cloudflare Connect 2026 (read on 28 October 2026) shows Matthew Prince as Co-founder and CEO, Michelle Zatlyn as Co-founder and President and Dane Knecht as CTO, each in a card with their name and portrait, and the blog post introducing it names Zatlyn as co-founder and President. Cloudflare's press release of 20 October 2026 also names Knecht as chief technology officer. The co-chair titles come from Wikipedia's Cloudflare article. Lee Holloway's step-down in 2015 was sourced to TechCrunch, which its robots.txt puts off limits, so it was dropped from his role on 6 November 2026. Product people stay on their own listings. Copied from the cloudflare-sandbox-sdk listing on 6 November 2026 without its product manager; the library's changelog credits maintainers by GitHub handle only. On 6 November 2026 the GitHub issues link was corrected from the Sandbox SDK's to this library's repository, and the Sandbox SDK's product-team sources were removed.\n- Cloudflare: LinkedIn https://www.linkedin.com/company/cloudflare X https://x.com/cloudflare GitHub https://github.com/cloudflare\n\n### Ownership and investors\n\n- Ownership: Public company (NYSE: NET)\n\n### Getting support\n\n- Discord: https://discord.cloudflare.com\n- Help: https://developers.cloudflare.com/support/contacting-cloudflare-support/\n- Community (Forum): https://community.cloudflare.com\n- Community (GitHub issues): https://github.com/cloudflare/workers-oauth-provider/issues\n- Sources: https://www.cloudflare.com/our-story/, https://www.cloudflare.com/, https://developers.cloudflare.com/support/, https://developers.cloudflare.com/support/contacting-cloudflare-support/, https://developers.cloudflare.com/, https://github.com/cloudflare/workers-oauth-provider, https://www.cloudflare.com/connect/cold-start/\n\n## Live (updated 2026-11-07 17:45 UTC)\n\n- Vendor status page: a major outage, Partial System Outage\n- github `cloudflare/workers-oauth-provider` v1.2.4, released 2026-10-22\n- npm `@cloudflare/workers-oauth-provider` 1.2.4\n- security.txt: valid\n- Watching changelog \u003chttps://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/cloudflare-workers-oauth-provider.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration\n- PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope\n- Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them\n- MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite\n- Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md\n\n## Weaknesses\n\n- Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n- Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply\n- 1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing\n- The consent page and user sign-in are left to the developer's own `/authorize` handler\n- No audit log of grants or token use is built in\n\n\n\n## Before you call it (notes for agents)\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n## Connect\n\nInstall:\n\n```bash\nnpm install @cloudflare/workers-oauth-provider\n```\n\nThrough letme: https://letme.dev/cloudflare-workers-oauth-provider. letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Descope Agentic Identity Hub | A | 78.1 | 25 | auth.oauth, auth.tokens, auth.consent | no | https://www.anchorterminal.com/tools/descope-agentic-identity.md |\n| Amazon Bedrock AgentCore Identity | BB | 76.4 | 44 | auth.oauth, auth.tokens, auth.consent | no | https://www.anchorterminal.com/tools/agentcore-identity.md |\n| Auth0 for AI Agents (Token Vault) | BB | 74.3 | 88 | auth.oauth, auth.tokens, auth.consent | no | https://www.anchorterminal.com/tools/auth0-ai-agents.md |\n| Scalekit AgentKit | BB | 72.2 | 136 | auth.oauth, auth.tokens, auth.consent | no | https://www.anchorterminal.com/tools/scalekit-agentkit.md |\n| Vercel Connect | BB | 70.8 | 185 | auth.tokens, auth.oauth, auth.consent | no | https://www.anchorterminal.com/tools/vercel-connect.md |\n| Aembit | B | 68.4 | 286 | auth.oauth, auth.tokens, auth.consent | no | https://www.anchorterminal.com/tools/aembit.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- v1.2.4 published to npm on 22 October 2026 with provenance, nine npm releases in the 90 days to 6 November and first published on 16 March 2025 (source: \u003chttps://www.npmjs.com/package/@cloudflare/workers-oauth-provider\u003e)\n- The 1.2.0 changelog entry, a minor release, says clients registered with a remote http redirect URI or a private-use scheme stop authorizing, with an opt-in for RFC 8252 native-app schemes (source: \u003chttps://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md\u003e)\n- storage-schema.md says client secrets are stored as SHA-256 hashes, props are AES-GCM encrypted and tokens and codes expire through KV TTLs; dynamically registered clients default to 90 days (source: \u003chttps://github.com/cloudflare/workers-oauth-provider/blob/main/storage-schema.md\u003e)\n- HISTORY.md says the library was largely written with the help of Claude and reviewed line by line by Cloudflare engineers against the RFCs (source: \u003chttps://github.com/cloudflare/workers-oauth-provider/blob/main/HISTORY.md\u003e)\n- Open issues filed on 24 and 28 October 2026 report that an authorization code can be exchanged twice under concurrent token requests and that grant revocation isn't final under KV eventual consistency, neither with a reply on 6 November (source: \u003chttps://github.com/cloudflare/workers-oauth-provider/issues\u003e)\n- Cloudflare's MCP authorization page, last updated 27 October 2026, gives deployable examples with Stytch, Auth0, WorkOS and Descope (source: \u003chttps://developers.cloudflare.com/agents/model-context-protocol/authorization/\u003e)\n\n- #4 of 18 in Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Compare\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md): B 68.4 vs BB 76.2\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md): BB 76.4 vs BB 76.2\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md): B 64 vs BB 76.2\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md): BB 74.3 vs BB 76.2\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md): BB 76.2 vs A 78.1\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md): BB 76.2 vs D 49.3\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md): BB 76.2 vs BB 74.5\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md): BB 76.2 vs B 65.5\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md): BB 76.2 vs BB 72.2\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md): BB 76.2 vs B 63.8\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md): BB 76.2 vs BB 70.8\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md): BB 76.2 vs B 66.4\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on cloudflare.com or one of its subdomains, or the README at the root of github.com/cloudflare/workers-oauth-provider. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"cloudflare-workers-oauth-provider\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/cloudflare-workers-oauth-provider.svg\" alt=\"Cloudflare Workers OAuth Provider on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Cloudflare Workers OAuth Provider on Anchor Terminal](https://www.anchorterminal.com/badges/cloudflare-workers-oauth-provider.svg)](https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider\"\u003eCloudflare Workers OAuth Provider on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Cloudflare Workers OAuth Provider is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/cloudflare-workers-oauth-provider-dark.png\n- Light: https://www.anchorterminal.com/assets/share/cloudflare-workers-oauth-provider-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Agent auth \u0026 delegated access", "url": "https://www.anchorterminal.com/categories/agent-auth" }, { "name": "Cloudflare Workers OAuth Provider", "url": "" } ], "description": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "facts": [ "rank #47 of 1486", "OAuth auth", "0 desk reviews" ], "h1": "Cloudflare Workers OAuth Provider", "image": "https://www.anchorterminal.com/assets/og/tools-cloudflare-workers-oauth-provider.png", "path": "/tools/cloudflare-workers-oauth-provider", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider review (2026), grade BB", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider" }, "tokens": { "markdown": 7300, "slim": 1380 }, "version": 1 }